public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix: jwt regex validation error during skip-jwt-bearer-tokens flow (#2888) 

---------

Co-authored-by: Jan Larwig <jan@larwig.com>
This commit is contained in:
stomekpe 2025-01-15 09:06:21 +01:00 committed by GitHub
parent fafb47e45a
commit f31e02cebd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG.md
View File

@ -8,6 +8,8 @@
## Changes since v7.8.0 ## Changes since v7.8.0
- [#2887](https://github.com/oauth2-proxy/oauth2-proxy/issues/2887) fix: jwt regex validation error during skip-jwt-bearer-tokens flow
# V7.8.0 # V7.8.0
## Release Highlights ## Release Highlights

2
pkg/middleware/jwt_session.go
View File

@ -13,7 +13,7 @@ import (
k8serrors "k8s.io/apimachinery/pkg/util/errors" k8serrors "k8s.io/apimachinery/pkg/util/errors"
) )
const jwtRegexFormat = `^ey[IJ][a-zA-Z0-9_-]*\.ey[IJ][a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$` const jwtRegexFormat = `^ey[a-zA-Z0-9_-]*\.ey[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`
func NewJwtSessionLoader(sessionLoaders []middlewareapi.TokenToSessionFunc) alice.Constructor { func NewJwtSessionLoader(sessionLoaders []middlewareapi.TokenToSessionFunc) alice.Constructor {
js := &jwtSessionLoader{ js := &jwtSessionLoader{

6
pkg/middleware/jwt_session_test.go
View File

@ -71,6 +71,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
// validToken will pass the token regex so can be used to check token fetching // validToken will pass the token regex so can be used to check token fetching
// is valid. It will not pass the OIDC Verifier however. // is valid. It will not pass the OIDC Verifier however.
const validToken = "eyJfoobar.eyJfoobar.12345asdf" const validToken = "eyJfoobar.eyJfoobar.12345asdf"
const validTokenWithSpace = "eyAidHlwIjogIkpXVCIsICJraWQiOiAiRTJlWW5ZMWR1eGttTkpiVGdCRzd4MkVpNVJZPSIsICJhbGciOiAiUlMyNTYiIH0K.eyJfoobar.12345asdf"
Context("JwtSessionLoader", func() { Context("JwtSessionLoader", func() {
var verifier middlewareapi.VerifyFunc var verifier middlewareapi.VerifyFunc
@ -294,6 +295,11 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
expectedErr: nil, expectedErr: nil,
expectedToken: validToken, expectedToken: validToken,
}), }),
Entry("Bearer <valid-token-with-whitespace>", findBearerTokenFromHeaderTableInput{
header: fmt.Sprintf("Bearer %s", validTokenWithSpace),
expectedErr: nil,
expectedToken: validTokenWithSpace,
}),
Entry("Basic invalid-base64", findBearerTokenFromHeaderTableInput{ Entry("Basic invalid-base64", findBearerTokenFromHeaderTableInput{
header: "Basic invalid-base64", header: "Basic invalid-base64",
expectedErr: errors.New("invalid basic auth token: illegal base64 data at input byte 7"), expectedErr: errors.New("invalid basic auth token: illegal base64 data at input byte 7"),